We are using keycloak, not SSO. There is no long-term-support keycloak version available, so we are considering buying into Redhat SSO.